https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Tue, 29 Sep 2026 08:39:38 +0000 https://vulnerability.circl.lu/vuln/cve-2026-42779 <p><strong>Affected:</strong> Apache Software Foundation Apache MINA</p> <p>The fix for CVE-2026-41635 was not applied to the 2.1.X and 2.2.X branches. Here was the original issue description:</p> <p>Apache MINA&#39;s AbstractIoBuffer.resolveClass() contains two branches, one of them (for static classes or primitive types) does not check the class at all, bypassing the classname allowlist and allowing arbitrary code to be executed.</p> <p>The fix checks if the class is present in the accepted class filter before calling Class.forName().</p> <p>Affected versions are Apache MINA 2.1.0 &lt;= 2.1.11, and 2.2.0 &lt;= 2.2.6.</p> <p>The problem is resolved in Apache MINA 2.1.12, and 2.2.7 by applying the classname allowlist earlier.</p> <p>Affected are applications using Apache MINA that call IoBuffer.getObject().</p> <p>Applications using Apache MINA are advised to upgrade.</p> <p><strong>Affected:</strong> Apache Software Foundation Apache MINA</p> <p>The fix for CVE-2026-41635 was not applied to the 2.1.X and 2.2.X branches. Here was the original issue description:</p> <p>Apache MINA&#39;s AbstractIoBuffer.resolveClass() contains two branches, one of them (for static classes or primitive types) does not check the class at all, bypassing the classname allowlist and allowing arbitrary code to be executed.</p> <p>The fix checks if the class is present in the accepted class filter before calling Class.forName().</p> <p>Affected versions are Apache MINA 2.1.0 &lt;= 2.1.11, and 2.2.0 &lt;= 2.2.6.</p> <p>The problem is resolved in Apache MINA 2.1.12, and 2.2.7 by applying the classname allowlist earlier.</p> <p>Affected are applications using Apache MINA that call IoBuffer.getObject().</p> <p>Applications using Apache MINA are advised to upgrade.</p> https://vulnerability.circl.lu/vuln/cve-2026-42779